T1685.005 Clear Windows Event Logs — Attack Simulation

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. With administrator privileges, the event logs can be cleared with the following utility commands: * `wevtutil cl system` *…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Clear Event Logs via VBA
windows automated powershell
Procedure 1b682d84-f075-4f93-9a89-8a8de19ffd6e; elevation required; cleanup not declared. Not executed or individually validated.
BlackCat Ransomware Full Log Clear
windows automated command_prompt
Procedure 83dac837-5685-45ed-b10b-9f047572100b; elevation required; cleanup not declared. Not executed or individually validated.
Delete System Logs Using Clear-EventLog
windows automated powershell
Procedure b13e9306-3351-4b4b-a6e8-477358b0b498; elevation required; cleanup not declared. Not executed or individually validated.
Clear Logs
windows automated command_prompt
Procedure e6abb60e-26b8-41da-8aae-0c35174b0967; elevation required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Windows defense-impairment isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation potential_disruption_requires_individual_review

can_simulate subtechnique source_mapped

Detection and collection

T1685.005 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.